CVE-2020-14399: High severity Libvncserver Project Libvncserver vulnerability
DISPUTED An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly "no trust boundary crossed."
Other sources
An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32t pointers in libvncclient/rfbproto.c.
Upstream commit:
https://github.com/LibVNC/libvncserver/commit/23e5cbe6b090d7f22982aee909a6a618174d3c2d
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libvncserverto a version that resolves this vulnerability.Fixed in 0.9.13 - Upgrade
Upgrade
debian/libvncserverto a version that resolves this vulnerability.Fixed in 0.9.13+dfsg-2+deb11u1Fixed in 0.9.14+dfsg-1+deb12u1Fixed in 0.9.15+dfsg-1+deb13u1Fixed in 0.9.15+dfsg-6 - Upgrade
Upgrade
LibVNCServerto a version that resolves this vulnerability.Fixed in 0.9.13
Event History
Frequently Asked Questions
What is CVE-2020-14399?
CVE-2020-14399 is a vulnerability discovered in LibVNCServer before 0.9.13.
What is the severity of CVE-2020-14399?
The severity of CVE-2020-14399 is high with a severity value of 7.5.
How does CVE-2020-14399 affect LibVNCServer?
CVE-2020-14399 allows access to byte-aligned data through uint32_t pointers in libvncclient/rfbproto.c.
Which versions of LibVNCServer are affected by CVE-2020-14399?
Versions before 0.9.13 of LibVNCServer are affected by CVE-2020-14399.
How can I fix CVE-2020-14399?
To fix CVE-2020-14399, upgrade LibVNCServer to version 0.9.13 or higher.